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Applicant: Norbert ALBRECHT et al. 
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PRELIMINARY AMENDMENT 

Commissioner for Patents 
Washington, D.C. 20231 

Sir: 

This paper accompanies the documents submitted for entry into the U.S. national 
stage under 35 U.S.C. §371 . The claims were not amended under Article 1 9 but were 
amended under Article 34 and the amended claims are presented on "AMENDED 
SHEETS" appended to the International Preliminary Examination Report, a translation 
of which is submitted with the national stage documents. 

Before calculation of the filing fee and before examination on the merits, kindly 
amend this application in accordance with the following particulars. 

IN THE CLAIMS : 

Please substitute amended claims 1,9, 19 and 21 as they appear in the annex 
to the IPER for the original filed claims 1, 9, 19 and 21, as shown on the appended 
APPENDIX OF AMENDED CLAIMS. 



A marked up version of the amended claims is submitted herewith. 
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COMMENTS 

The Appendix of Amended Claims includes all of the claims presently in the 
application, including original filed claims that have not been amended. 

The amendments to claims 1, 9, 19 and 21 have been made to present these 
claims as they appear in the annex to the IPER in proper order in the claims to be 
examined. No substantive amendments have been made to the claims as annexed 
to the IPER. Claims 1, 9, 19 and 21 as annexed to the IPER simply have been 
placed in proper order to enable processing and examination of the application. 

All rights are retained with respect to the subject matter of the original filed 
claims. Examination of the application as amended is respectfully requested. 

Respectfully submitted, 
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Alexandria, Virginia 22314 

Telephone: (703) 683-0500 
Facsimile: (703)683-1080 

Date: January 11, 2002 

S:\Producer\jek\ALBRECHT - ALBR3001\prehminary amendment. wpd 



-2- 



, ± o € j :s o o J @ y - g g g g up g 
531 Rec'd PCT/n\ 1 1 JAN 2002 
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Appendix of Amended Claims 

1. (Amended)A system for performing a transaction having 

a node computer (40, 41 ) connected with terminals (1 0, 11 ) via a terminal 
network (30), 

a plurality of terminals (10, 11) each having an apparatus (15) for 
accessing a portable data carrier (80) and being suitable for performing 
a plurality of different transactions, the suitability of a terminal (10,11) for 
performing a further transaction being providable by said terminal 
receiving data via the terminal network (30) which set up the functionality 
required for performing the further transaction, the data being made 
available in the node computer (40, 41) and the node computer (40, 41) 
supplying them to a terminal (10, 1 1) when the latter requests them after 
ascertainment of the intended transaction (102, 302), 
characterized in that 

the transaction is performed in interaction between the node computer 
(40, 41) and a terminal (10, 11) while accessing a portable data carrier 
(80), the terminal (10, 11) and the node computer (40, 41) each 
performing partial steps of the transaction. 

2. A system according to claim 1 , characterized in that at least one transaction is 
performed in interaction between a terminal (10, 11) and a node computer (41). 

3. A system according to claim 1 , characterized in that the terminal (10,11) causes 
transfer of the data for setting up the functionality for performing the transaction. 

4. A system according to claim 3, characterized in that the terminal (10,11) causes 
data transmission following the occurrence of a predetermined event in the terminal (10, 
11). 



-1- 



J_ O O 3 O U:? -H ». "O 62 ± o J «* 

5. A system according to claim 3, characterized in that the terminal (10,11) causes 
data transmission following the triggering of the certain transaction in the terminal (10, 
11). 

6. A system according to claim 1 , characterized in that the node computer (40, 41 ) 
is connected via a background network (50) with at least one central processing unit 
(60, 61) and the latter is includable in a transaction. 

7. A system according to claim 3, characterized in that the node computer (40, 41 ) 
can call data from the central processing unit (60, 61). 

8. A system according to claim 1 , characterized in that the node computer (40, 41 ) 
has a cipherbox (17) which processes information for encrypting and decrypting the 
traffic effected with the terminal (10, 11). 

9. (Amended)A terminal for performing a transaction having 

a processor unit (12), 

a storage device (20) connected therewith for receiving data which set up 

the functionality of the processor unit (12), 

means (13, 14, 15) for triggering a transaction, and 

an interface (18) for connection with a node computer (41 ) via a terminal 

network (30), 

an apparatus (15) for reading a portable data carrier (80), 
the processor unit (12) causing the setup of the terminal (10, 11) for 
performing the transaction after ascertainment of the intended transaction 
by requesting data from the node computer (40, 41) which provide the 
functionality required for performing the transaction, 

characterized in that 

the terminal (10, 1 1) performs the transaction in interaction with a node 
computer (40, 41 ), the terminal (1 0, 1 1 ) and the node computer (40, 41 ) 
each performing partial steps of the transaction, and the terminal (10, 11) 
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accessing a portable data carrier (80) in order to take information required 
for performing the transaction therefrom. 

1 0. A terminal according to claim 9, characterized in that it requests the data for set- 
ting up a functionality from the node computer (41) following the occurrence of a 
predetermined event. 

11. A terminal according to claim 9, characterized in that the predetermined event 
is the triggering of a transaction whose performance requires a functionality which is 
present only incompletely or not at all in the storage device (20). 

12. A terminal according to claim 9, characterized in that it has a security box (17) 
which contains information for encrypting and decrypting the traffic effected with the 
node computer (40, 41). 

13. A terminal according to claim 9, characterized in that the means for triggering a 
transaction include a keyboard (13) and a display (14). 

14. A terminal according to claim 9, characterized in that it has an apparatus (15) for 
reading portable data carriers (80). 

15. A terminal according to claim 9, characterized in that it sends a start sequence 
(106) comprising information for identifying the terminal (10, 1 1) to the node computer 
(40, 41) for requesting data for setting up a new functionality. 

16. A terminal according to claim 9, characterized in that the storage device (20) 
and/or the processor unit (12) are formed at least partly on a portable data carrier (80). 

17. A terminal according to claim 9, characterized in that the start sequence (106) 
comprises information about the type of transaction triggered. 



-3- 



18. A terminal according to claim 9, characterized in that when a transaction has 
been triggered it executes all program instructions already present in the form of data 
and executable for this purpose in the storage device (20) and optionally 

adds resulting temporary results to the start sequence (106). 

19. (Amended)A method for performing a transaction using a terminal (10, 11) 
connected via a terminal network (30) with a node computer (41), 

the transaction being triggered by means of the terminal (10, 11 ), 

a start sequence (1 06) designating the transaction being transmitted from 

the terminal (10, 11) to the node computer (40, 41), and 

data providing the functionality required for performing the transaction in 

the terminal (10,11) then being retransmitted by the node computer (40, 

41) to the terminal (10, 11), 
characterized in that 

the node computer (41) is involved in performing the transaction, the 

transaction being performed in interaction between the terminal (10, 11) 
and the node computer (40, 41) and comprising the following steps. 

20. A method according to claim 19, characterized in that when a transaction has 
been triggered the terminal (10, 11) checks whether the data already present in the 
storage device (20) permit the transaction to be performed and directly performs the 
transaction if possible (104). 

21. (Amended)A method for operating a terminal (10, 11) suitable for performing a 
transaction and connected via a terminal network (30) with a node computer (40, 41) 
involved in performing the transaction, at least one functionality being required for 
performing a transaction, 

characterized by the following steps: 

monitoring the terminal (1 0, 1 1 ) for occurrence of a predetermined event, 
transmitting a start sequence designating a transaction from the terminal 

(10, 11) to the node computer (40, 41) upon occurrence of a 

predetermined event, 
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retransmitting data providing at least one 

functionality required for performing the transaction in the terminal (10, 
11) from the node computer (40, 41) to the terminal (10, 11). 
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MARKED UP VERSION OF AMENDED CLAIMS 

I. [A system for performing a transaction having 

a node computer (40, 41) connected with terminals (10, 11) via a 
terminal network (30), 

a plurality of terminals (10, 11) each having an apparatus (15) for 
accessing a portable data carrier (80) and being suitable for performing 
a plurality of different transactions, the suitability of a terminal (10, 11) 
for performing a further transaction being providable by said terminal 
receiving data via the terminal network (30) which set up the 
functionality required for performing the further transaction, the data 
being made available in the node computer (40, 41) and the node 
computer (40, 41) supplying them to a terminal (10, 11) when the latter 
requests them after ascertainment of the intended transaction (102, 
302), 

characterized in that 

the transaction is performed in interaction between the node computer 
(40, 41) and a terminal (10, 11) while accessing a portable data carrier 
(80), the terminal (10, 11) and the node computer (40, 41) each 
performing partial steps of the transaction.] 

9. [A terminal for performing a transaction having 
a processor unit (12), 

a storage device (20) connected therewith for receiving data which set 

up the functionality of the processor unit (12), 

means (13, 14, 15) for triggering a transaction, and 

an interface (18) for connection with a node computer (41) via a 

terminal network (30), 
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an apparatus (15) for reading a portable data carrier (80), 
the processor unit (12) causing the setup of the terminal (10, 11) for 
performing the transaction after ascertainment of the intended 
transaction by requesting data from the node computer (40, 41) which 
provide the functionality required for performing the transaction, 

characterized in that 

the terminal (10, 11) performs the transaction in interaction with a node 
computer (40, 41), the terminal (10, 11) and the node computer (40, 
41) each performing partial steps of the transaction, and the terminal 
(10, 11) accessing a portable data carrier (80) in order to take 
information required for performing the transaction therefrom.] 

19. [A method for performing a transaction using a terminal (10, 11) connected 

via a terminal network (30) with a node computer (41), 

the transaction being triggered by means of the terminal (10, 11 ), 
a start sequence (106) designating the transaction being transmitted 
from the terminal (10, 11) to the node computer (40, 41), and 
data providing the functionality required for performing the transaction 
in the terminal (10, 11) then being retransmitted by the node computer 
(40, 41) to the terminal (10, 11), 

characterized in that 

the node computer (41) is involved in performing the transaction, the 
transaction being performed in interaction between the terminal 
(10,11) and the node computer (40, 41) and comprising the following 
steps.] 

21. [A method for operating a terminal (10, 11) suitable for performing a 
transaction and connected via a terminal network (30) with a node computer (40, 41) 
involved in performing the transaction, at least one functionality being required for 
performing a transaction, 
characterized by the following steps: 

monitoring the terminal (10, 1 1) for occurrence of a predetermined 

event, 

transmitting a start sequence designating a transaction from the 
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terminal (10, 11) to the node computer (40, 41) upon occurrence of a 
predetermined event, 

retransmitting data providing at least one functionality required for 
performing the transaction in the terminal (10, 1 1) from the node 
computer (40, 41) to the terminal (10, 11).] 
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System for performing a transaction 
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This invention starts out from a system according to the preamble of the main 



Such a system is known from EP-B-0 305 004. The system for performing finan- 
cial transactions described here provides terminals on the user side a plurality of which 
are connected in parallel arrangement with a so-called concentrator. The concentrators 
are in turn connected in parallel arrangement via a bank network with a background 
bank system. The connections between the system parts are protected independently of 
each other against spying out of the traffic passing therethrough. The connections be- 
tween terminals and concentrators are protected using security boxes preferably de- 
signed in the form of smart cards on the terminal side. The decisive element of the sys- 
tem structure is the concentrators performing the communication with the background 
system and having all means required therefor. The terminals connected with a con- 
centrator are only capable of communication with the respective preceding concentra- 
tor. The structure of the terminals can thus be kept simple. 

A difficulty with multisubscriber systems like the aforementioned is the setup of 
new system features or the change of existing ones. The involved problems become 
evident in particular when a system change to be made, e.g. the introduction of a new 
software security feature, relates to at least two system subscribers and the latter are 
technically not identical. System adaptation must then normally be performed indi- 
vidually for each type of subscriber. If the functionality of a terminal cannot be 
changed later, the terminal must be completely replaced. 

DE-A1-38 15 071 in addition discloses adapting a communication terminal in the 
form of a teletex terminal or television receiver to a given use situation on site by re- 
loading program packages. The device has a microprocessor unit, a storage device, an 
interface to an external program source and a plurality of assemblies to be controlled 
by the microprocessor unit. Activation and control of the assemblies are effected with 
the aid of application program packages which are transmitted to the storage device 
from the external program source before the first use of the device. The proposed con- 
cept allows the production of technically uniform devices which are adjusted to the 



claim. 



:i U O 3 O O H h. O fa kl: i o if 

-2- 

adjusted to the place of use on site by loading corresponding application program pack- 
ages. 

The concept described in DE-A-38 15 071 offers the greatest benefit when the 
communication devices are prepared at the factory for performing all the functions that 
are at all possible and have all the assemblies necessary therefor as well as an accord- 
ingly large storage device. Communication devices of this type can be produced com- 
paratively reasonably by mass production but are oversized for many applications. Eve- 
ryday use of the devices furthermore presupposes that the particular device has been 
prepared for performing the desired function upon setup by loading a corresponding 
application program package. In other words, only functionalities previously set up in 
a separate setup step can be used. Each new functionality or change of an existing one 
must be set up in a separate operating step. 

The invention is based on the problem of providing a flexible transaction system 
with very simply constructed terminals which simplifies the introduction of new sys- 
tem features or the change of existing ones. 

This problem is solved by a system having the features of the main claim. The 
problem is in addition solved by a terminal according to independent claim 9 and a 
method according to independent claim 19. 

The inventive system is characterized by the fact that the functionality of a ter- 
minal is not permanently defined by its technical design or setup but is variable and 
only determined by software which it receives from a preceding node computer. As far 
as the technical design of the terminals is concerned there is only the specification that 
they be able to accept software supplied by the node computers and execute it. Within 
the limits of this specification the terminals can be designed freely and in particular 
independently of their later functionality. Terminals can advantageously be of techni- 
cally uniform design for very different transactions. Transferring essential parts of the 
possible functionalities to the node computers permits simple design of the terminals. 
This advantageously also permits the terminal-node computer interface to be defined 
independently of the functionality of the terminal, thus independently of the type of 
terminal and thus uniformly for all types of terminal. The free designability of the ter- 
minal within fixed limits in connection with uniform design of the terminal-node com- 
puter interfaces substantially facilitates the setup of new system software features 
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and/or the change of existing ones. An especially favorable embodiment provides that 
system changes take effect on the terminals virtually without delay. Since its function- 
ality is fundamentally configurable freely anytime, each terminal can be used for per- 
forming several different transactions. Terminal functionalities can also be newly set 
up anytime and the development of software for new functionalities is substantially 
facilitated since no interfaces, network or terminal peculiarities need be heeded. In 
addition, servicing and maintenance routines are considerably facilitated. 

The proposed transaction system is suitable for, among other things, use in bank 
or payment transaction applications, issuing electronic tickets or for health insurance 
cards. 

An inventive terminal according to independent claim 9 is characterized in that it 
permits the structure of a transaction system according to the main claim. 

The inventive method according to independent claim 19 has the advantage that 
its carrying out leads to a system according to the main claim. 

Further expedient embodiments and advantageous developments of the system 
according to the main claim, of the terminal according to independent claim 9 and of 
the method according to independent claim 19 can be found in the respective depend- 
ent claims. 

An example of the invention will be explained in more detail in the following 
with reference to the drawing, in which: 

Figure 1 shows the structure of a transaction system, 

Figure 2 shows a detail of the structure shown in Figure 1, 

Figure 3 shows a flow chart to illustrate the operation of a transaction system, 

Figure 4 shows a flow chart of an operating variant, 

Figure 5 shows an example of a data exchange between a terminal and a node 
computer, 

Fig. 6 shows a data exchange using a terminal for issuing an electronic ticket, 
Fig. 7 shows a data exchange using a terminal for handling health insurance 
cards. 

Figure 1 shows terminal 1 1 for performing a transaction which is connected with 
node computer 40 via terminal network 30. Node computer 40 is in turn connected 
with central processing unit 50 via background network 60. Terminal network 30 can 
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have connected thereto in parallel with terminal 11 further terminals 10 which have the 
same basic structure as terminal 1 1 but need not be identically designed. Background 
network 50 can have connected thereto in parallel with node computer 41 further node 
computers 40 each of which is again the starting point for terminal network 30 to 
which one or more terminals 10 are connected. Background network 50 can further- 
more have connected thereto in parallel with central processing unit 60 further central 
processing units 61. Terminal network 30 and background network 50 can be designed 
completely or partly as fixed or wireless networks; in particular terminal network 30 
can be realized via the Internet. The connection of terminals 10, 11, node computers 
40, 41 and also central processing units 60, 61 to respective networks 30, 50 can ac- 
cordingly also be of wire-bound and/or contactless type. 

The network structure shown in Fig. 1 permits a plurality of different transactions 
to be performed, including payment functions in the form of direct debiting or a purse, 
credit card functions, charge card functions, applications of a terminal user, health in- 
surance functions, servicing and maintenance functions or diagnostic functions. 

Fig. 2 shows more elaborately a detail of the network structure illustrated in 
Fig. 1 having terminal 11, node computer 41 and central processing unit 61. A main ele- 
ment of terminal 1 1 is microprocessor 12 connected via intradevice bus 16 with 
storage device 20, operating apparatus 13, picture display unit 14, user data interface 
15, contact-type or contactless interface 16 to terminal network 30, and security box 
17. Storage device 20 is divided as known in the art into volatile section 21, usually in 
the form of a RAM, which serves in particular as a working memory for processor 12, 
and nonvolatile section 22, which is again divided into read-only area 23, usually in 
the form of a ROM, and read- write area 24, usually in the form of an EEPROM. Read- 
only area 23 contains in particular initial operating program data which are imperative 
for providing basic operativeness of terminal 1 1 and must not be changed later, in par- 
ticular a bootstrap for loading program packages for defining the terminal functional- 
ity. Read- write area 24 preferably contains all data which provide the functionality of 
the terminal in connection with initial operating program data in read-only area 23. 

Operating apparatus 13 enables a user to trigger and/or continue a transaction. It 
thus has actuating means by which the user can generate control signals to be supplied 



to processor 12 via bus 16. Input of control signals is supported by display on picture 
display unit 14. In a common embodiment the operating apparatus is designed as a 
keypad which can be integrated expediently into picture display unit 14 in the form of 
soft keys. To increase system security, operating apparatus 13 can have means for 
identifying a user, e.g. means that evaluate biometric data such as a fingerprint recog- 
nizer. 

User data interface 15 is preferably designed as a read/write unit for communica- 
tion with portable data carrier 80 which forms part of terminal 1 1 for the following 
description. Data carrier 80 bears microcomputer 81 which in turn has a microproces- 
sor and a memory, whereby the latter may fundamentally be constructed like storage 
device 20. Communication between user data interface 15 and microcomputer 81 can 
be of contact or contactless type. Portable data carrier 80 is expediently designed as a 
smart card or magnetic stripe card but can also have any other form of appearance, e.g. 
the form of a watch. 

Security box 17 supports system security and contains information for encrypting 
and decrypting information outputted via interface 16 to terminal network 30 and in- 
coming from there, in order to prevent unauthorized persons from spying out the traf- 
fic through terminal network 30. 

Portable data carrier 80 contains information required for performing a transac- 
tion with the aid of terminal 11. Such information may be for example an account 
number for performing a banking transaction, a value memory content for performing 
a payment operation, the name of an insurance for preparing a medical treatment bill- 
ing, or a sum memory content for recording bonus information. Microcomputer 81 of 
portable data carrier 80 can in addition contain data for providing a terminal function- 
ality. Furthermore it can contain operationally necessary elements of terminal-side 
processor 12, terminal-side storage device 20 or security box 17, so that operation of 
terminal 1 1 is possible only together with portable data carrier 80. If they are designed 
as elements of data carrier 80, processor 12, storage device 20 and/or security box 17 
can accordingly be completely or partly omitted on the terminal side. Other terminal 
components 13, 14 can also accordingly be realized partly or completely on data car- 
rier 80; their selection and type of distribution can fundamentally be designed freely 
from the point of view of expediency. 
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Node computer or computers 40, 41 form servers for terminals 10, 11, perform- 
ing the transactions triggered via connected terminals 10, 11 in interaction with termi- 
nals 10, 11 and making connections between terminals 10, 1 1 and central processing 
units 60, 61 via background network 50. For performing these functions, node com- 
puters 40, 41 are equipped with accordingly efficient processor units 44 and large stor- 
age devices 45. Processor unit 44 is connected with terminal network 30 via contact- 
less or contact-type first interface 42, and with background network 50 via contactless 
or contact-type second interface 43. For protecting both the traffic to terminals 10, 1 1 
and the traffic to background network 50, node computer 41 has cipherbox 46. It man- 
ages and processes information for encrypting and decrypting the data exchange ef- 
fected with particular terminal 10, 11 or central processing unit 60, 61. Encryption and 
decryption are based on mechanisms known in the art. 

An important function of node computer 41 is to provide the terminal functional- 
ity required for performing a transaction after triggering of the transaction on terminal 
10, 11. Storage device 45 therefore normally contains a plurality of data for providing 
functionalities possible on connected terminals 10, 11. 

Central processing units 60, 61 typically have the form of usual computing cen- 
ters as found at network operators, banks, credit card institutions, loading centers, au- 
thorization centers, service centers and the like. Since central processing units 60, 61 
are well known in this sense and they are used only in their known functions for the in- 
ventive system, their structure will not be dealt with in any detail here. 

A characteristic property of the transaction system shown in Figure 1 is that the 
particular functionality of terminals 10, 11 is not firmly associated therewith but de- 
fined by software which they receive from node computers 41. This definition may be 
permanent or vary depending on the situation. Essential parts of a functionality can 
advantageously be transferred to node computers 40, 41. Figure 2 illustrates this prop- 
erty with reference to the sequence of steps in performing a transaction. 

A user first triggers a transaction via operating apparatus 13, step 100. Following 
the trigger signal, terminal processor 12 checks whether the data for providing the 
functionality required for the intended transaction are available in storage device 20. If 
that is the case, processor 12 directly performs the first transaction steps possible with 
the available data, step 102. For example, for a transaction to be performed by means 
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of smart card 80, processor 12 causes user data interface 15 (then designed as a read- 
ing unit) to read the card data out of the memory of card microcomputer 81 and asks 
the user to input further control signals via operating apparatus 13, e.g. user identifica- 
tion information. Furthermore, processor 12 generates a start sequence, step 106, 
which states the transaction that was triggered and contains that information identify- 
ing particular terminal 10, 11. 

If the check in step 102 yields that the data for providing a functionality required 
for performing a transaction are not present in storage device 20, processor 12 only 
forms the start sequence. The start sequence and, if available, the data present due to 
first performed transaction steps, are encrypted by processor 12 with the aid of the pro- 
tection information contained in security box 17 and sent via terminal network 30 to as- 
sociated node computer 41. 

Processor unit 44 thereof receives the data via interface 42 and decrypts them 
with the aid of the decryption information contained in cipherbox 46. Processor unit 44 
thereupon checks the decrypted data for whether they consist only of a start sequence 
or already comprise the result data of first transaction steps, step 1 10. In the former 
case, processor unit 44 determines from the start sequence the terminal functionality 
required for performing the triggered transaction and checks whether the correspond- 
ing data are present in storage device 45 of node computer 41 . If that is not the case, 
processor unit 44 requests them from central processing unit 60, 61 via background 
network 50. When the necessary data are present, processor unit 44 makes them avail- 
able for transfer to terminal 11, step 116. 

If the check in step 110 yields that the first data received from terminal 10, 1 1 al- 
ready comprise results of first performed transaction steps, processor unit 44 processes 
them and generates first response data. It normally does so conducting a data exchange 
with central processing units 60, 61 via background network 50. 

Subsequent to the processing of the first data, processor unit 44 checks whether 
terminal 1 1 is to be supplied further data for providing the required functionality for 
performing the next transaction steps, step 1 14. If this is the case, it continues perform- 
ing step 116 and checks whether the required data are present in storage device 45. If it 
ascertains that required data are not present in storage device 45 it requests them from 
corresponding central processing unit 60, 61 via background network 50. The data, if 
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The data, if they are required, and the first response data are thereupon sent by node 
computer 40, 41 to terminal 1 1 via terminal network 30. 

If the response data sent back by node computer 41 are solely data for providing 
a functionality, i.e. the necessary data were not available in storage device 20 of termi- 
nal 1 1 upon triggering of the transaction, terminal processor 12 accepts the data in 
storage device 20. Then it causes the first transaction steps to be performed. It sends 
back the resulting first data to node computer 41 which thereupon performs step se- 
quence 102 in sequence. 

If the data sent back to terminal 1 1 by node computer 41 comprise more exten- 
sive response data, terminal processor 12 causes the next transaction steps to be per- 
formed. If further data for providing the functionality required for performing the trans- 
action were transferred with the more extensive response data, it accepts them in 
storage device 20 and uses them directly for performing the next transaction steps. 

The data for providing the functionality for performing the transaction can be re- 
tained in the storage device after the end of the transaction. When the transaction is 
next performed, terminal processor 12 then performs the first transaction steps after 
the triggering of a transaction directly without previously requesting the data for pro- 
viding the required functionality from node computer 41. Terminal 1 1 can perform the 
transactions possible due to a functionality again anytime without any need to request 
data from node computer 40, 41. 

It can be provided, on the other hand, that the data for providing the functionality 
for a transaction are deleted after the end of the transaction. Terminal processor 12 
then newly loads the data necessary for providing the required functionality each time 
a transaction is performed. Storage device 20 can in this case consist only of volatile 
memory area 21 along with area 23 for storing the initial program data. 

The transmission of data required for providing the functionality for a certain 
transaction need not necessarily be triggered by triggering the transaction itself. It can 
also be effected independently of the actual triggering of a certain transaction. The trig- 
ger can be any defined events. For example, it can be provided that the data for the 
most important or most frequently performed transactions are transmitted to a terminal 
when the terminal is first connected to a network. In a variant, data for the most impor- 
tant or most frequently performed transactions are loaded when any one of the most 
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most important or most frequent transactions is triggered for the first time. A further 
possible trigger event is a servicing or maintenance measure performed on the termi- 
nals regularly or upon request. In all cases a data transmission, once triggered, can be 
used for regularly updating functionalities already set up in a terminal, whereby 
outdated versions are overwritten with current ones in the memory of the terminal. 

Fig. 4 illustrates a possible sequence of a data transmission, which is not directly 
bound to a transaction, from the node computer to the terminal. 

The sequence is started by the occurrence of a predetermined event, step 101, e.g. 
a servicing time being reached. 

Terminal 1 1 then forms a start sequence again, step 106, which states the transac- 
tion that was triggered and contains information identifying particular terminal 1 1 and 
sends it to the associated node computer. 

Node computer 41 checks whether the start sequence defines data clearly to be 
transmitted directly, step 111. 

If that is not the case, the node computer generates an inquiry to detect the data to 
be transmitted to the terminal and sends it to the terminal, step 113. 

The terminal executes the inquiry and states the desired data to the node com- 
puter in a corresponding response, step 1 15. 

Node computer 41 then checks whether the required data are present in storage 
device 45. If it ascertains that required data are not present in its storage device 45, it 
requests them from corresponding central processing unit 61 via background network 
50. It thereupon sends the data to terminal 1 via terminal network 30, step 119. 

If the information about the data to be transmitted follows directly from the start 
sequence upon its check in step 1 1 1, the node computer directly performs step 119. 

It can further be provided that the terminals are already equipped with a selection 
of functionalities in the new state. The selection can expediently include the most im- 
portant or most frequently used functionalities. If in particular the storage capacity 
permits, all possible functionalities can also be set up on a terminal. 

Figure 5 illustrates a possible data exchange between node computer 41 and ter- 
minal 1 1 used as a payment transaction terminal. For the shown data exchange, essen- 
tial parts of the functionality are realized in node computer 41 . Let it be assumed that 
the data for providing the functionality "payment transaction" are already present in 
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in storage device 20 of terminal 1 1 and that the transactions performable by terminal 
1 1 presuppose the use of smart card 80. The transaction is a payment operation 
involving book transfer of an amount of money from an account corresponding to 
smart card 80 at a first bank with central processing unit 61 to an account at a second 
bank with central processing unit 61. Terminal 1 1 is a terminal installed with a dealer, 
for which a virtual dealer card, i.e. a data carrier in the manner of a smart card realized 
in program form, is created in associated node computer 41. 

The payment transaction is triggered by inserting smart card 80 into user data in- 
terface 15 designed as a reading device. When terminal 11 recognizes that a transac- 
tion is to be performed, the user's authorization to use card 80 is expediently first 
checked in known fashion, e.g. by checking a PIN. If said check is positive, terminal 
1 1 reads general card data, e.g. a card number and/or banking connection, out of mem- 
ory 83 of the smart card. If the card permits a plurality of different transactions, being 
e.g. operable alternatively as a purse or debit or credit card, terminal 1 1 asks the user 
by a display on picture display unit 14 to select a transaction, i.e. select a mode of 
payment. It then asks the user by a display on picture display unit 14 to input an 
amount to be transferred. Furthermore, terminal 1 1 provides data for terminal identifi- 
cation and date information. From general card data, amount, terminal information 
data and date information the terminal forms a start sequence, step 200, which it sends 
to node computer 41. The sending of the start sequence and the total following data 
exchange between terminal 1 1 and node computer 41 are effected in encrypted form, 
using encryption methods known in the art. A first key is expediently allocated to ter- 
minal 11, being formed within the framework of the start sequence or possibly in a pre- 
ceding step on the basis of the terminal identification. It serves in the following as an 
overlapping transport key for protecting the total data exchange between terminal 1 1 
and node computer 41. A further key is expediently allocated to smart card 80, being 
used to form data protection codes in order to permit in particular a check of the intact- 
ness of data. 

Node computer 41 determines central processing unit 61 corresponding to the 
banking connection designated in the start sequence where the account belonging to 
card 80 is created, step 202. It begins a data exchange with determined central process- 
ing unit 61 . This involves for example first a check of whether the intended payment 
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payment operation is permitted at all. If the intended transaction is thus fundamentally 
possible, node computer 41 transfers to terminal 1 1 data which set up terminal 1 1 for 
performing the intended transaction and in particular include instructions which cause 
user data interface 15 to access smart card 80 further, step 204. The data also contain in- 
structions which cause terminal 1 1 to report who the recipient or giver of a payment is 
to be. 

Terminal 1 1 executes the received data and smart card instructions, step 206. 
When smart card 80 is prepared for performing a debit, terminal 1 1 sends node com- 
puter 41 after encryption a response, step 208, which in this example contains informa- 
tion that a payment is to be made from the card to the virtual dealer card associated 
with the terminal. 

Node computer 41 determines from the response who an amount to be debited or 
credited to card 80 or the associated account is to be credited or debited to, in the as- 
sumed example the virtual dealer card. With reference to the terminal information data 
sent in the start sequence, node computer 41 therefore reads the memory of the virtual 
dealer card and determines central processing unit 60 associated with the dealer card. 
It thereupon opens a data exchange with the latter, step 210, to set up the virtual dealer 
card for crediting. 

When smart card 80 and dealer card are prepared, node computer 41 sends ter- 
minal 1 1 transaction instructions which cause the debit to be entered in the memory of 
smart card 80 on the terminal side, step 218. Parallel thereto it notes the corresponding 
credit in the memory of the virtual dealer card and causes the transaction to be per- 
formed between involved central processing units 60, 61 in a data exchange via back- 
ground network 50. 

Terminal 1 1 enters the debit on the smart card, step 220, and acknowledges the 
end of the transaction by returning an acknowledgement to node computer 41, step 
222. 

When the accounting part of the transaction is over, node computer 41 generates 
control data which cause terminal 1 1 to show a voucher display for the performed 
transaction, i.e. the performed accounting operation, on picture display unit 14, step 
224. If terminal 1 1 has a voucher output associated therewith, e.g. in the form of a 
printer, node computer 41 expediently also generates control data for printing a 
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voucher. It sends the control data to terminal 1 1 which executes them without further 
processing, step 226. 

Fig. 6 illustrates as a further possible use of the transaction system shown in 
Fig. 2 a variant in which terminal 1 1 is used to issue electronic tickets. It is assumed 
that the electronic ticket has the form of a data record which is entered in the memory 
of smart card 80. Terminal 1 1 accordingly has user data interface 15 in the form of a 
smart card contacting unit. 

A ticket issuing transaction is triggered by the customer presenting smart card 80 
to terminal 1 1 and/or reporting e.g. via operating apparatus 13 that he wants to perform 
the transaction "electronic ticket," step 300, in order to acquire an electronic ticket. 
When terminal 1 1 then recognizes that a ticket issuing transaction is to be performed, a 
check of the customer's authorization to use smart card 80 for the intended transaction 
can first be provided, e.g. in known fashion by checking a PIN. 

When it is certain that the transaction "electronic ticket" is to be performed and 
the customer is entitled to perform the transaction, terminal 1 1 determines the card 
number of smart card 80 and checks whether it is set up for further performing an 
"electronic ticket" transaction, step 302. If that is not the case, it further ascertains 
whether sufficient free memory space is available for setting up the functionality. 

Subsequently terminal 1 1 generates start sequence 306 comprising the card num- 
ber and a terminal identification. If the functionality required for performing the trans- 
action "electronic ticket" is not present in storage device 20 of terminal 11, start se- 
quence 306 furthermore comprises information indicating that terminal 1 1 requires the 
data for setting up the functionality, said data being referred to as application in the 
following. 

Start sequence 306 is encrypted by means of an overlapping transport key associ- 
ated with terminal 1 1 and generated using the terminal identification within the 
framework of the start sequence or in a preceding, separate data exchange by a usual 
method. The transport key protects the total subsequent data exchange between termi- 
nal 1 1 and node computer 41. Generation and use of the key are based in known fash- 
ion on the communication participants each knowing independently of each other a 
secret which cannot be exchanged between terminal 1 1 and node computer 41 via ter- 
minal network 30. The secret is, on the one hand, firmly stored in terminal 11, prefera- 
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preferably in security box 17, and, on the other hand, managed in node computer 41 or 
via background network 50 by central processing units 60, 61. If a secret necessary for 
generating a key is not available in node computer 41, the latter procures it from man- 
aging central processing unit 60, 61. 

Terminal 1 1 sends encrypted start sequence 306 to associated node computer 41. 
Processor unit 44 thereof checks after receiving - and decrypting - start sequence 306 
whether the application "electronic ticket" is present in storage device 45 of node 
computer 41, step 308. If that is not the case, node computer 41 determines, e.g. with 
the aid of the terminal information, central processing unit 60, 61 which has the data 
realizing the application and requests the data therefrom via background network 50. 
When application data are ready, step 310, node computer 41 transfers them to termi- 
nal 11. 

Processor 12 thereof accepts the application data in storage device 20 and exe- 
cutes the set up functionality, step 312. Terminal 1 1 asks the customer via picture dis- 
play unit 14 to select a ticket. Selection is effected interactively in prompted fashion. 
Using operating apparatus 13 the customer provides, when requested by picture dis- 
play unit 14, information necessary for determining the required ticket, e.g. starting 
point and destination, time of travel, number of persons, travel class, etc., step 314. 
When all information necessary for determining a ticket has been inputted into termi- 
nal 11, terminal 11 transfers the selection data to node computer 41. 

From the information on ticket selection received from terminal 1 1 node com- 
puter 41 determines a data record representing the electronic ticket, step 316. Node 
computer 41 is expediently set up to perform simple and especially frequently re- 
quested ticket determinations, e.g. determination of a ticket for the local transport ser- 
vice, directly by processor unit 44 of node computer 41. In many cases, however, the 
determination of a ticket involves complex program runs which usually necessitate the 
intervention of central processing unit 60, 61 via background network 50. The result- 
ing ticket data record might comprise, along with the information used for determina- 
tion, possible ticket alternatives and in particular the fare or fares. 

Node computer 41 thereupon generates from the card number as well as a secret 
also firmly stored in smart card 80 a smart card-specific key which is subsequently 
used for forming a data protection code, step 318. 
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When node computer 41 has generated a smart card-specific key, it uses it to 
form a data protection code, e.g. a MAC (message authentication code), for the result- 
ing ticket data record, and encrypts the resulting ticket data block consisting of ticket 
data record and data protection code with the aid of the transport key, step 320. Node 
computer 41 transfers the resulting encrypted ticket data block to terminal 11. 

Terminal 1 1 decrypts the incoming ticket data block with the aid of the transport 
key which it generates, e.g. in security box 17, in the same way as node computer 41. 
Terminal 1 1 performs a precheck of the intactness of the ticket data record by e.g. 
checking whether the decrypted ticket data record has certain values at defined posi- 
tions. Terminal 1 1 passes the decrypted ticket data record on to smart card 80 which 
checks its intactness by checking the data protection code by means of the smart card- 
specific key present on smart card 80. 

If the ticket data record proves to be intact, terminal 1 1 asks the customer by a 
corresponding display on picture display unit 14 to check the electronic ticket for cor- 
rectness and confirm the purchase, step 322. If the ticket data record comprises several 
possible electronic ticket alternatives, terminal 1 1 asks the customer to make a selec- 
tion among the offered alternatives. In simple cases without alternatives, for example 
the purchase of a ticket for a local transport service, no selection or confirmation of 
purchase by the customer is necessary. 

When the electronic ticket sent to terminal 1 1 is accepted by the customer, the 
confirmed part of the ticket data record constituting the selected ticket is first buffered 
in storage device 20 of terminal 11, step 324. In addition, terminal 11 causes payment 
of the electronic ticket, step 326. The payment operation can be effected by cash pay- 
ment or e.g. by collection of electronic money stored on smart card 80, as described in 
connection with Fig. 5. 

When the payment operation is completed, node computer 41 generates an ac- 
knowledge signal, step 328, which it transfers to node computer 41. 

After receiving the acknowledge signal, node computer 41 generates a control in- 
struction which causes processor 12 of terminal 1 1 to transmit the ticket data record 
stored in storage device 20 to smart card 80. 

Terminal 1 1 performs transmission of the electronic ticket to the smart card, step 
330, and acknowledges the end of the transaction by returning an acknowledgement to 
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node computer 41, step 332. The reception of said acknowledgement in node computer 
41 can be followed for example by the output of a voucher, e.g. by a printer connected 
to terminal 1 1 . 

Fig. 7 illustrates as a further possible use of the transaction system shown in 
Fig. 2 a variant in which a terminal is used in a health insurance card system. It is as- 
sumed that the health insurance card again has the form of smart card 80 and the func- 
tionality for handling health insurance cards is already present in storage device 20 of 
terminal 1 1 . Terminal 1 1 is located for example in a doctor's office, hospital or institu- 
tion for billing medical services, e.g. a health insurance company. Medical staff are 
granted different access rights to health insurance card 80 compared to the health in- 
surance company members. 

A transaction using health insurance card 80, simply designated card in the fol- 
lowing, is started by card 80 being presented to user data interface 15 of terminal 11, 
step 400. Terminal 1 1 then confirms via picture display unit 14 that a transaction was 
requested using a health insurance card and - in normal operation - asks the operator to 
state whether he wants to access card 80 in read-only mode or in read- write mode, step 
402. Further, it asks the operator, step 404, to state which data stored on card 80 he 
wants to access. The data kept in the storage device of card 80 are expediently classi- 
fied according to their objective nature, e.g. accountingwise or medically, this classifi- , 
cation being finely subdivided further e.g. in the manner of the medical specialty. The 
areas of classification are protected against read and write accesses by field-related 
access keys individually or in groups. The access keys are preferably derived from the 
card-specific key and information characterizing the operator, e.g. a doctor, or the area 
of classification, e.g. a medical specialty. 

When it is certain which access mode for which area of card 80 the operator de- 
sires, terminal 1 1 asks the operator via picture display unit 14 to identify himself, step 
406. This can be done for example by means of operating apparatus 13 by input of a 
code for identifying a doctor, hospital or health insurance. In addition, terminal 1 1 de- 
termines the card number of card 80. 

From the information on desired access mode, card area to be accessed, identifi- 
cation code, number of presented card 80 and from the terminal identification, terminal 
11 forms a start sequence, step 408, which it transmits to associated node computer 41. 
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computer 41. Transmission takes place in encrypted form using a transport key which 
is generated using the terminal identification possibly in a preceding data exchange 
step and is used to protect the total subsequent data exchange between terminal 1 1 and 
node computer 41 . 

After start sequence 408 arrives in node computer 41 the latter forms a card- 
specific key with the aid of the card number and a secret allocated to card 80. If the 
secret is not present in node computer 41 itself, it determines it via background net- 
work 50 from managing central processing unit 60, 61. 

Node computer 41 thereupon checks whether the information necessary for 
evaluating start sequence 408 is located in storage device 45. If that is not the case, it 
determines central processing unit 60 suitable for evaluating the start sequence and 
starts a data exchange therewith via background network 15, step 412. In the course of 
the following data exchange, node computer 41 checks, using the operator identifica- 
tion code transmitted with start sequence 408, whether the access to card 80 desired by 
the operator is permissible. If that is the case, setup data are provided in node com- 
puter 41 which enable terminal 1 1 to perform the desired access to card 80, step 414. 
The setup data preferably comprise for this purpose one or more access keys each as- 
sociated with individual areas of card 80. 

For the setup data, node computer 41 thereupon forms a data protection code by 
means of the card-specific key, step 416. The data record consisting of setup data and 
data protection code is then encrypted with the transport key and sent to terminal 1 1 . 

The latter decrypts the received data record with the aid of the transport key, at 
the same time performing a precheck of the data record for intactness, e.g. by checking 
the presence of certain data items at defined positions of the data record. If the pre- 
check is positive, terminal 1 1 transfers the setup data to card 80. The latter checks the 
setup data for intactness with the aid of the card-specific key by checking the correct- 
ness of the data protection code. If intactness of the setup data is ascertained, card 80 
can then be accessed according to the setup data via terminal 11. 

Besides the accesses possible in normal operation, an access mode for emergen- 
cies is expediently also set up in terminal 1 1 . An emergency transaction is triggered 
like a transaction in normal operation, but the operator identifies himself in step 406 
not by individual personal identification but by an emergency identification. 
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When node computer 41 or central processing unit 60, 61 recognizes an emer- 
gency identification when evaluating start sequence 408 after generation of a key for 
forming a data protection code and a transport key, it makes a set of access keys avail- 
able in node computer 41 with reference to the card number so as to permit at least 
read access to all medical data located on health insurance card 80. To accelerate exe- 
cution of the transaction it can be provided that an additional check of the operator's 
authorization is omitted. The node computer provides the access key data record with a 
data protection code, step 416, encrypts the two with the transport key and transfers 
the resulting data record to terminal 1 1 . 

The latter decrypts the received data record again with the transport key and 
passes it on to card 80 for a check of intactness by means of the card-specific key. If 
intactness of the transferred key data record is ascertained, terminal 1 1 allows read ac- 
cess to all medical data present on card 80. 

While retaining the basic concept of determining the functionality of the user- 
side terminals by preceding node computers in a transaction system, the proposed sys- 
tem, the components used for realizing it and the operating method can be varied 
within wide limits. This applies e.g. to the physical structure of terminals 10, 11. Their 
components can be combined if storage device 20, processor 12, cryptobox 17 and 
operating apparatus 13 form one unit for example. Terminal network 30 can have con- 
nected thereto a plurality of node computers 40, 41 which are used for performing dif- 
ferent transactions. The possible uses of the system are of course not limited to the 
described examples. Along with the type of transactions, in particular the distribution 
of the functionality over terminals and node computers can also be varied. The func- 
tionality allocated to the terminal can be limited to passing data through to a data car- 
rier; on the one hand, while extensive data processing directly by a terminal can be set 
up, on the other hand. Without impairing the basic overall concept, the encryption con- 
cept with transport key and data carrier-related key can further be varied within wide 
limits, whereby encryption can be fully omitted, on the one hand, and additional en- 
cryptions provided, on the other hand. 
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Claims 

1 . A system for performing transactions having 

- a plurality of terminals suitable for performing a plurality of different transac- 
tions, and 

- a node computer connected with the terminals via a terminal network, 

- the suitability of a terminal for performing a transaction being providable via 
a node computer by the latter transferring data to the terminal which set up the 
functionality required for performing the transaction therein, 

characterized in that 

at least one terminal (10, 1 1) is designed to cause the setup for performing a fur- 
ther transaction during its customary use by requesting data providing the func- 
tionality required for performing the further transaction from a node computer 
(40, 41) following a trigger signal generated in connection with the performance 
of a transaction. 

2. A system according to claim 1, characterized in that at least one transaction is 
performed in interaction between a terminal (10, 11) and a node computer (41). 

3. A system according to claim 1, characterized in that the terminal (10, 11) causes 
transfer of the data for setting up the functionality for performing the transaction. 

4. A system according to claim 3, characterized in that the terminal (10, 1 1) causes 
data transmission following the occurrence of a predetermined event in the ter- 
minal (10, 11). 

5. A system according to claim 3, characterized in that the terminal (10, 1 1) causes 
data transmission following the triggering of the certain transaction in the termi- 
nal (10, 11). 

6. A system according to claim 1, characterized in that the node computer (40, 41) 
is connected via a background network (50) with at least one central processing 
unit (60, 61) and the latter is includable in a transaction. 

7. A system according to claim 3, characterized in that the node computer (40, 41) 
can call data from the central processing unit (60, 61). 
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8. A system according to claim 1, characterized in that the node computer (40, 41) 
has a cipherbox (17) which processes information for encrypting and decrypting 
the traffic effected with the terminal (10, 11). 

9. A terminal for performing a transaction having 

- a processor unit (12), 

- a storage device (20) connected therewith for receiving data which set up the 
functionality of the processor unit (12), 

- means (13, 14, 15) for triggering a transaction, and 

- an interface (18) for connection with a node computer (41) via a terminal net- 
work (30), 

characterized in that the processor unit (12) causes the setup of the terminal (10, 
11) for performing a further transaction in the course of customary use of the 
terminal (10, 11) following a trigger signal generated in connection with the per- 
formance of a transaction by requesting data from a node computer (40, 41) 
which provide the functionality required for performing the transaction. 

10. A terminal according to claim 9, characterized in that it requests the data for set- 
ting up a functionality from the node computer (41) following the occurrence of a 
predetermined event. 

11. A terminal according to claim 9, characterized in that the predetermined event is 
the triggering of a transaction whose performance requires a functionality which 
is present only incompletely or not at all in the storage device (20). 

12. A terminal according to claim 9, characterized in that it has a security box (17) 
which contains information for encrypting and decrypting the traffic effected 
with the node computer (40, 41). 

13. A terminal according to claim 9, characterized in that the means for triggering a 
transaction include a keyboard (13) and a display (14). 

14. A terminal according to claim 9, characterized in that it has an apparatus (15) for 
reading portable data carriers (80). 

15. A terminal according to claim 9, characterized in that it sends a start sequence 
(106) comprising information for identifying the terminal (10, 1 1) to the node com- 
puter (40, 41) for requesting data for setting up a new functionality. 
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16. A terminal according to claim 9, characterized in that the storage device (20) 
and/or the processor unit (12) are formed at least partly on a portable data carrier 
(80). 

17. A terminal according to claim 9, characterized in that the start sequence (106) 
comprises information about the type of transaction triggered. 

18. A terminal according to claim 9, characterized in that when a transaction has 
been triggered it executes all program instructions already present in the form of 
data and executable for this purpose in the storage device (20) and optionally 
adds resulting temporary results to the start sequence (106). 

19. A method for performing a transaction using a terminal connected via a terminal 
network with a node computer involved in performing the transaction, 

having the following steps: 

- triggering a transaction by means of the terminal (10, 11), 

- transmitting a start sequence (106) designating the transaction from the termi- 
nal (10, 1 1) to the node computer (40, 41), 

- retransmitting data providing the functionality required for performing the 
transaction in the terminal (10, 11) from the node computer (40, 41) to the ter- 
minal (10, 11). 

20. A method according to claim 19, characterized in that when a transaction has 
been triggered the terminal (10, 11) checks whether the data already present in 
the storage device (20) permit the transaction to be performed and directly per- 
forms the transaction if possible (104). 

21 . A method for operating a terminal suitable for performing a transaction and con- 
nected via a terminal network with a node computer involved in performing the 
transaction, at least one functionality being required for performing a transaction, 
having the following steps: 

- monitoring the terminal (10, 1 1) for occurrence of a predetermined event, 

- transmitting a start sequence (106) designating a transaction from the terminal 
(10, 1 1) to the node computer (40, 41) upon occurrence of a predetermined 
event, 
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retransmitting data providing at least one functionality required for perform- 
ing the transaction in the terminal (10, 11) from the node computer (40, 41) to 
the terminal (10, 11). 
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Abstract 

A system is proposed for performing transactions with terminals which funda- 
mentally allow a plurality of different transactions to be performed. The terminals (10, 
1 1) are connected for this purpose via a terminal network (30) with at least one node 
computer (40, 41) via which they can be set up for performing a transaction. The suit- 
ability for performing a further, hitherto unprepared transaction can be provided later 
anytime without any special setup measures. A terminal (10, 11) requests for this pur- 
pose data providing the functionality required for performing the further transaction 
from a node computer (40, 41) following a trigger signal designating the further trans- 
action. The transaction is then performed in interaction between a terminal (10, 1 1) 
and a node computer (40, 41). 
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